OpenClaw Critical Flaw: How a Single Validation Bug Exposed 135K Instances

OpenClaw's pairing approval mechanism fails to validate user permissions, allowing anyone with basic access to grant themselves admin rights in under 30 seconds. With 135,000+ instances publicly exposed and 63% running zero authentication, the trivial exploit path has almost certainly been weaponized since the two-day window between patch and public disclosure. Immediate patching to version 2026.3.28 and forensic auditing are essential for all affected organizations.